The Latest in IT Security

Another Document Targeting Uyghur Mac Users


We spotted a new variant of the documents used in the cyber attacks against Uyghur back in February.

This variant was first submitted to VirusTotal on April 11 from China. This time it uses IUHRDF, which may be a reference to International Uyghur Human Rights & Democracy Foundation, instead of Captain as the author:

Properties of poadasjkdasuodrr.doc

The payload is still the same besides using different filenames and command and control server.

It uses “” as the command and control server:

Command and control server name

It creates the following copy of itself and launch point:

~/Library/Application Support/.realPlayerUpdate

Or it may create the following instead (when executed with 2 parameters):

/Library/Application Support/.realPlayerUpdate

It remains pretty much the same malware and is generically detected as Backdoor:OSX/CallMe.A since February.

MD5: ee84c5d626bf8450782f24fd7d2f3ae6 – poadasjkdasuodrr.doc
MD5: 544539ea546e88ff462814ba96afef1a – .realPlayerUpdate

Leave a reply


FRIDAY, JULY 19, 2019

Mission-Critical Broadband – Why Governments Should Partner with Commercial Operators:
Many governments embrace mobile network operator (MNO) networks as ...

ARA at Scale: How to Choose a Solution That Grows With Your Needs:
Application release automation (ARA) tools enable best practices in...

The Multi-Model Database:
Part of the “new normal” where data and cloud applications are ...



Latest Comments

Social Networks